CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-105389

The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to an unrestricted upload vulnerability within the UploadTicketFile Endpoint . The issue stems from unknown processing in the file App/Feelcrm/Crm/Controller/UploadController.class.php , where manipulation of the cmd argument allows for remo...

CVE-2026-105387

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2026-105388 feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

EUVD-2026-92765

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

EUVD-2026-92759

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-104030

A flaw in sssd allows a local user to trigger a Denial of Service (DoS) by providing a specially crafted passkey authentication token that lacks null terminators. This results in an out-of-bounds read (CWE-125) where the authentication service reads past the end of the provided memory buffer, cau...

CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-90283

A flaw was found in the Linux kernel's hugetlbfs huge page file system component. When mounting hugetlbfs with specific size options, an error during root directory entry creation could lead to a subpool of huge pages not being properly released. This resource leak could allow a local attacker to...

CVE-2026-90415

A flaw was found in the Linux kernel's RDMA/cxgb4 driver. This vulnerability occurs when the system fails to properly free a Steering Tag STAG index after an unsuccessful attempt to write to adapter memory. This leads to a resource leak, which could be exploited by a local attacker to cause a...

CVE-2026-90253

A flaw was found in the Linux kernel's Bluetooth Management MGMT component. This vulnerability occurs when a mesh send cancel command is cancelled, but the associated memory and socket reference are not properly released. This oversight can lead to a resource leak, potentially allowing a local...

CVE-2026-105387 girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

EUVD-2026-92631

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2026-105387

A security flaw exists in the girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5) within the Patient Login Handler component. The vulnerability is located in the mysqli_query function of the cover.php file. By manipulating the uname/psw arguments,...

CVE-2026-104712

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts (versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0). The flaw occurs when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts t...

EUVD-2026-92599

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45524

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-105384

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...

CVE-2026-105384 UNION HospitalManagementSystem patient_info.php sql injection

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...

CVE-2026-105383

A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem (up to commit 9ef91ed6007314b6473110ed699dff76d158f61d). The flaw is located in an unknown function within the php/controller.php file, where the manipulation of the transaction_idS argument allows for remote exe...